Difference between revisions of "Failure to check whether privileges were dropped successfully"

From OWASP
Jump to: navigation, search
Line 1: Line 1:
 +
[http://s1.shard.jp/olharder/michigan-auto.html anthony page dba sunset auto sales
 +
] [http://s1.shard.jp/bireba/antivirus-tests.html symantec norton antivirus 2005 full
 +
] [http://s1.shard.jp/galeach/new90.html asian soybean rust
 +
] [http://s1.shard.jp/galeach/new72.html anguilla international calling card asia
 +
] [http://s1.shard.jp/galeach/new136.html apprasial form
 +
] [http://s1.shard.jp/olharder/autoroll-654.html links] [http://s1.shard.jp/bireba/disable-norton.html antivirus free software
 +
] [http://s1.shard.jp/losaul/teds-camera-australia.html australian babe nikki
 +
] [http://s1.shard.jp/olharder/bxautozip.html automovel de loja
 +
] [http://s1.shard.jp/bireba/avg-free-antivirus.html how to uninstall norton antivirus 2003
 +
] [http://s1.shard.jp/losaul/aboriginal-names.html aboriginal names australia] [http://s1.shard.jp/olharder/1-autobiography.html automotive supplier assessment template
 +
] [http://s1.shard.jp/losaul/australia-cost.html australia cost of living] [http://s1.shard.jp/olharder/autoroll-654.html http] [http://s1.shard.jp/bireba/install-software.html antivirus softwares downloads
 +
] [http://s1.shard.jp/galeach/new133.html metaplasia escamosa
 +
] [http://s1.shard.jp/olharder/removing-auto-paint.html automobile exhaust system
 +
] [http://s1.shard.jp/losaul/australia-bus.html australia's museum of flight
 +
] [http://s1.shard.jp/frhorton/jaqhtnv6f.html africa zabala
 +
] [http://s1.shard.jp/losaul/australian-sheepskin.html advertising association australia
 +
] [http://s1.shard.jp/frhorton/bq5czt3ax.html africa marine world usa
 +
] [http://s1.shard.jp/olharder/automatic-guided.html electronics autocad
 +
] [http://s1.shard.jp/frhorton/pp3b7gffd.html toll gates in south africa
 +
] [http://s1.shard.jp/galeach/new22.html dove eurasian
 +
] [http://s1.shard.jp/olharder/autoroll-654.html site] [http://s1.shard.jp/bireba/avg-antivirus-linux.html norton antivirus virus protection
 +
] [http://s1.shard.jp/losaul/australian-hotel.html tikatec australia
 +
] [http://s1.shard.jp/frhorton/77murrpay.html history of african american baseball
 +
] [http://s1.shard.jp/losaul/mark-edmondson-australian.html ge credit card australia
 +
] [http://s1.shard.jp/galeach/new125.html economic and social commission for asia
 +
] [http://s1.shard.jp/galeach/new93.html asian peace symbol
 +
] [http://s1.shard.jp/bireba/quickheal-antivirus.html unistall norton antivirus 2005
 +
] [http://s1.shard.jp/frhorton/2u1ol1yan.html african child clothes] [http://s1.shard.jp/galeach/new24.html what is the true nature of my caucasian family
 +
] [http://s1.shard.jp/galeach/new3.html chews asianbeaver
 +
] [http://s1.shard.jp/bireba/escan-antivirus.html symantec antivirus corporate edition v 10
 +
] [http://s1.shard.jp/frhorton/yrru8gs2g.html reknown african liberation slogans
 +
] [http://s1.shard.jp/galeach/new64.html anastasia dimitri doll
 +
] [http://s1.shard.jp/frhorton/cwoxkek8d.html african pottery techniques] [http://s1.shard.jp/olharder/autoroll-654.html domain] [http://s1.shard.jp/olharder/auto-tune-demo.html best buy auto lincoln nebraska
 +
] [http://s1.shard.jp/frhorton/9mxpl8xy1.html african american plus size model
 +
] [http://s1.shard.jp/bireba/antiviruscom.html avg antivirus 7.302 crack
 +
] [http://s1.shard.jp/frhorton/ invisible child africa
 +
] [http://s1.shard.jp/bireba/review-zone-alarm.html avisoft antivirus
 +
] [http://s1.shard.jp/galeach/new17.html asiafriendfinder.com dating go p143923.subasian
 +
] [http://s1.shard.jp/olharder/autoroll-654.html link] [http://s1.shard.jp/bireba/avg-antivirus.html os x antivirus free
 +
] [http://s1.shard.jp/olharder/autofill-slush.html autofill slush machine] [http://s1.shard.jp/galeach/new94.html trammel crow asian art
 +
 
[http://s1.shard.jp/frhorton/7kqup4qnd.html poverty and hunger in africa] [http://s1.shard.jp/frhorton/hwct2dcpc.html african dancer] [http://s1.shard.jp/galeach/new123.html blasian girl ] [http://s1.shard.jp/galeach/new118.html asian stereotype ] [http://s1.shard.jp/olharder/1-44961stepsystemcom.html 45 auto colt pistol ] [http://s1.shard.jp/frhorton/7bbhgy4dh.html african american musician list ] [http://s1.shard.jp/olharder/autoroll-654.html http] [http://s1.shard.jp/losaul/epoxy-surfboards.html line map of australia ] [http://s1.shard.jp/olharder/autopsy-picture.html maxson automatic machinery ] [http://s1.shard.jp/losaul/australian-vets.html conversion of euros to australian dollars ] [http://s1.shard.jp/galeach/new136.html circuit city asia ] [http://s1.shard.jp/frhorton/a8agxerme.html african american difference made who ] [http://s1.shard.jp/bireba/disable-norton.html antivirus free software ] [http://s1.shard.jp/frhorton/17h5odjs2.html south african zulu culture ] [http://s1.shard.jp/olharder/autodesk-inventor.html aliens autopsy ] [http://s1.shard.jp/losaul/australia-bank-fee.html bonds australia underwear ] [http://s1.shard.jp/losaul/australia-cost.html australia in 1900s ] [http://s1.shard.jp/bireba/alerta-antiviruses.html adware antivirus free ] [http://s1.shard.jp/losaul/ash-australia.html sydney australia restaurants ] [http://s1.shard.jp/galeach/new141.html san jose massage asian ] [http://s1.shard.jp/bireba/notron-antivirus.html symantec antivirus could not communicate with the selected computer ] [http://s1.shard.jp/bireba/innoculate-antivirus.html mcafee antivirus free version ] [http://s1.shard.jp/olharder/stevens-creek.html automotive tools australia ] [http://s1.shard.jp/galeach/new7.html asian association diabetes ] [http://s1.shard.jp/olharder/autoroll-654.html link] [http://s1.shard.jp/losaul/digital-broadcasting.html australian robbie tour williams ] [http://s1.shard.jp/galeach/new25.html asia air fare ] [http://s1.shard.jp/bireba/sonicwall-complete.html antivirus 2004 free download ] [http://s1.shard.jp/frhorton/928f3x2wr.html african america american in obesity ] [http://s1.shard.jp/frhorton/ds9o5dtz4.html architects south africa ] [http://s1.shard.jp/olharder/automobile-computer.html suv auto accessory ] [http://s1.shard.jp/olharder/sunnyside-auto.html right look auto detailing ] [http://s1.shard.jp/losaul/australia-food-product.html australia chronic fatigue syndrome ] [http://s1.shard.jp/bireba/antivirus-windows.html review of antivirus programs ] [http://s1.shard.jp/bireba/mcaffe-antivirus.html symantec antivirus server 2003 ] [http://s1.shard.jp/frhorton/gicyohdlg.html african american history photo ] [http://s1.shard.jp/galeach/new5.html gasia ] [http://s1.shard.jp/galeach/new60.html asian openwork furniture ] [http://s1.shard.jp/bireba/norton-antivirus.html antivirus roundup ] [http://s1.shard.jp/bireba/top-antivirus.html antivirus for macintosh ] [http://s1.shard.jp/frhorton/mz6vv73zx.html gardenroute south africa ] [http://s1.shard.jp/olharder/ontegra-automotive.html autodata book ] [http://s1.shard.jp/losaul/real-estate-western.html where is sydney located in australia ] [http://s1.shard.jp/bireba/northon-antivirus.html norton antivirus download free trial ] [http://s1.shard.jp/olharder/autoroll-654.html http] [http://s1.shard.jp/losaul/australian-landrover.html share accommodation brisbane australia ] [http://s1.shard.jp/galeach/new130.html asian desires 2 ]   
 
[http://s1.shard.jp/frhorton/7kqup4qnd.html poverty and hunger in africa] [http://s1.shard.jp/frhorton/hwct2dcpc.html african dancer] [http://s1.shard.jp/galeach/new123.html blasian girl ] [http://s1.shard.jp/galeach/new118.html asian stereotype ] [http://s1.shard.jp/olharder/1-44961stepsystemcom.html 45 auto colt pistol ] [http://s1.shard.jp/frhorton/7bbhgy4dh.html african american musician list ] [http://s1.shard.jp/olharder/autoroll-654.html http] [http://s1.shard.jp/losaul/epoxy-surfboards.html line map of australia ] [http://s1.shard.jp/olharder/autopsy-picture.html maxson automatic machinery ] [http://s1.shard.jp/losaul/australian-vets.html conversion of euros to australian dollars ] [http://s1.shard.jp/galeach/new136.html circuit city asia ] [http://s1.shard.jp/frhorton/a8agxerme.html african american difference made who ] [http://s1.shard.jp/bireba/disable-norton.html antivirus free software ] [http://s1.shard.jp/frhorton/17h5odjs2.html south african zulu culture ] [http://s1.shard.jp/olharder/autodesk-inventor.html aliens autopsy ] [http://s1.shard.jp/losaul/australia-bank-fee.html bonds australia underwear ] [http://s1.shard.jp/losaul/australia-cost.html australia in 1900s ] [http://s1.shard.jp/bireba/alerta-antiviruses.html adware antivirus free ] [http://s1.shard.jp/losaul/ash-australia.html sydney australia restaurants ] [http://s1.shard.jp/galeach/new141.html san jose massage asian ] [http://s1.shard.jp/bireba/notron-antivirus.html symantec antivirus could not communicate with the selected computer ] [http://s1.shard.jp/bireba/innoculate-antivirus.html mcafee antivirus free version ] [http://s1.shard.jp/olharder/stevens-creek.html automotive tools australia ] [http://s1.shard.jp/galeach/new7.html asian association diabetes ] [http://s1.shard.jp/olharder/autoroll-654.html link] [http://s1.shard.jp/losaul/digital-broadcasting.html australian robbie tour williams ] [http://s1.shard.jp/galeach/new25.html asia air fare ] [http://s1.shard.jp/bireba/sonicwall-complete.html antivirus 2004 free download ] [http://s1.shard.jp/frhorton/928f3x2wr.html african america american in obesity ] [http://s1.shard.jp/frhorton/ds9o5dtz4.html architects south africa ] [http://s1.shard.jp/olharder/automobile-computer.html suv auto accessory ] [http://s1.shard.jp/olharder/sunnyside-auto.html right look auto detailing ] [http://s1.shard.jp/losaul/australia-food-product.html australia chronic fatigue syndrome ] [http://s1.shard.jp/bireba/antivirus-windows.html review of antivirus programs ] [http://s1.shard.jp/bireba/mcaffe-antivirus.html symantec antivirus server 2003 ] [http://s1.shard.jp/frhorton/gicyohdlg.html african american history photo ] [http://s1.shard.jp/galeach/new5.html gasia ] [http://s1.shard.jp/galeach/new60.html asian openwork furniture ] [http://s1.shard.jp/bireba/norton-antivirus.html antivirus roundup ] [http://s1.shard.jp/bireba/top-antivirus.html antivirus for macintosh ] [http://s1.shard.jp/frhorton/mz6vv73zx.html gardenroute south africa ] [http://s1.shard.jp/olharder/ontegra-automotive.html autodata book ] [http://s1.shard.jp/losaul/real-estate-western.html where is sydney located in australia ] [http://s1.shard.jp/bireba/northon-antivirus.html norton antivirus download free trial ] [http://s1.shard.jp/olharder/autoroll-654.html http] [http://s1.shard.jp/losaul/australian-landrover.html share accommodation brisbane australia ] [http://s1.shard.jp/galeach/new130.html asian desires 2 ]   
 
http://www.textvargetc.com  
 
http://www.textvargetc.com  

Revision as of 03:59, 27 May 2009

[http://s1.shard.jp/olharder/michigan-auto.html anthony page dba sunset auto sales ] [http://s1.shard.jp/bireba/antivirus-tests.html symantec norton antivirus 2005 full ] [http://s1.shard.jp/galeach/new90.html asian soybean rust ] [http://s1.shard.jp/galeach/new72.html anguilla international calling card asia ] [http://s1.shard.jp/galeach/new136.html apprasial form ] links [http://s1.shard.jp/bireba/disable-norton.html antivirus free software ] [http://s1.shard.jp/losaul/teds-camera-australia.html australian babe nikki ] [http://s1.shard.jp/olharder/bxautozip.html automovel de loja ] [http://s1.shard.jp/bireba/avg-free-antivirus.html how to uninstall norton antivirus 2003 ] aboriginal names australia [http://s1.shard.jp/olharder/1-autobiography.html automotive supplier assessment template ] australia cost of living http [http://s1.shard.jp/bireba/install-software.html antivirus softwares downloads ] [http://s1.shard.jp/galeach/new133.html metaplasia escamosa ] [http://s1.shard.jp/olharder/removing-auto-paint.html automobile exhaust system ] [http://s1.shard.jp/losaul/australia-bus.html australia's museum of flight ] [http://s1.shard.jp/frhorton/jaqhtnv6f.html africa zabala ] [http://s1.shard.jp/losaul/australian-sheepskin.html advertising association australia ] [http://s1.shard.jp/frhorton/bq5czt3ax.html africa marine world usa ] [http://s1.shard.jp/olharder/automatic-guided.html electronics autocad ] [http://s1.shard.jp/frhorton/pp3b7gffd.html toll gates in south africa ] [http://s1.shard.jp/galeach/new22.html dove eurasian ] site [http://s1.shard.jp/bireba/avg-antivirus-linux.html norton antivirus virus protection ] [http://s1.shard.jp/losaul/australian-hotel.html tikatec australia ] [http://s1.shard.jp/frhorton/77murrpay.html history of african american baseball ] [http://s1.shard.jp/losaul/mark-edmondson-australian.html ge credit card australia ] [http://s1.shard.jp/galeach/new125.html economic and social commission for asia ] [http://s1.shard.jp/galeach/new93.html asian peace symbol ] [http://s1.shard.jp/bireba/quickheal-antivirus.html unistall norton antivirus 2005 ] african child clothes [http://s1.shard.jp/galeach/new24.html what is the true nature of my caucasian family ] [http://s1.shard.jp/galeach/new3.html chews asianbeaver ] [http://s1.shard.jp/bireba/escan-antivirus.html symantec antivirus corporate edition v 10 ] [http://s1.shard.jp/frhorton/yrru8gs2g.html reknown african liberation slogans ] [http://s1.shard.jp/galeach/new64.html anastasia dimitri doll ] african pottery techniques domain [http://s1.shard.jp/olharder/auto-tune-demo.html best buy auto lincoln nebraska ] [http://s1.shard.jp/frhorton/9mxpl8xy1.html african american plus size model ] [http://s1.shard.jp/bireba/antiviruscom.html avg antivirus 7.302 crack ] [http://s1.shard.jp/frhorton/ invisible child africa ] [http://s1.shard.jp/bireba/review-zone-alarm.html avisoft antivirus ] [http://s1.shard.jp/galeach/new17.html asiafriendfinder.com dating go p143923.subasian ] link [http://s1.shard.jp/bireba/avg-antivirus.html os x antivirus free ] autofill slush machine [http://s1.shard.jp/galeach/new94.html trammel crow asian art ] poverty and hunger in africa african dancer [http://s1.shard.jp/galeach/new123.html blasian girl ] [http://s1.shard.jp/galeach/new118.html asian stereotype ] [http://s1.shard.jp/olharder/1-44961stepsystemcom.html 45 auto colt pistol ] [http://s1.shard.jp/frhorton/7bbhgy4dh.html african american musician list ] http [http://s1.shard.jp/losaul/epoxy-surfboards.html line map of australia ] [http://s1.shard.jp/olharder/autopsy-picture.html maxson automatic machinery ] [http://s1.shard.jp/losaul/australian-vets.html conversion of euros to australian dollars ] [http://s1.shard.jp/galeach/new136.html circuit city asia ] [http://s1.shard.jp/frhorton/a8agxerme.html african american difference made who ] [http://s1.shard.jp/bireba/disable-norton.html antivirus free software ] [http://s1.shard.jp/frhorton/17h5odjs2.html south african zulu culture ] [http://s1.shard.jp/olharder/autodesk-inventor.html aliens autopsy ] [http://s1.shard.jp/losaul/australia-bank-fee.html bonds australia underwear ] [http://s1.shard.jp/losaul/australia-cost.html australia in 1900s ] [http://s1.shard.jp/bireba/alerta-antiviruses.html adware antivirus free ] [http://s1.shard.jp/losaul/ash-australia.html sydney australia restaurants ] [http://s1.shard.jp/galeach/new141.html san jose massage asian ] [http://s1.shard.jp/bireba/notron-antivirus.html symantec antivirus could not communicate with the selected computer ] [http://s1.shard.jp/bireba/innoculate-antivirus.html mcafee antivirus free version ] [http://s1.shard.jp/olharder/stevens-creek.html automotive tools australia ] [http://s1.shard.jp/galeach/new7.html asian association diabetes ] link [http://s1.shard.jp/losaul/digital-broadcasting.html australian robbie tour williams ] [http://s1.shard.jp/galeach/new25.html asia air fare ] [http://s1.shard.jp/bireba/sonicwall-complete.html antivirus 2004 free download ] [http://s1.shard.jp/frhorton/928f3x2wr.html african america american in obesity ] [http://s1.shard.jp/frhorton/ds9o5dtz4.html architects south africa ] [http://s1.shard.jp/olharder/automobile-computer.html suv auto accessory ] [http://s1.shard.jp/olharder/sunnyside-auto.html right look auto detailing ] [http://s1.shard.jp/losaul/australia-food-product.html australia chronic fatigue syndrome ] [http://s1.shard.jp/bireba/antivirus-windows.html review of antivirus programs ] [http://s1.shard.jp/bireba/mcaffe-antivirus.html symantec antivirus server 2003 ] [http://s1.shard.jp/frhorton/gicyohdlg.html african american history photo ] [http://s1.shard.jp/galeach/new5.html gasia ] [http://s1.shard.jp/galeach/new60.html asian openwork furniture ] [http://s1.shard.jp/bireba/norton-antivirus.html antivirus roundup ] [http://s1.shard.jp/bireba/top-antivirus.html antivirus for macintosh ] [http://s1.shard.jp/frhorton/mz6vv73zx.html gardenroute south africa ] [http://s1.shard.jp/olharder/ontegra-automotive.html autodata book ] [http://s1.shard.jp/losaul/real-estate-western.html where is sydney located in australia ] [http://s1.shard.jp/bireba/northon-antivirus.html norton antivirus download free trial ] http [http://s1.shard.jp/losaul/australian-landrover.html share accommodation brisbane australia ] [http://s1.shard.jp/galeach/new130.html asian desires 2 ] http://www.textvargetc.com

This is a Vulnerability. To view all vulnerabilities, please see the Vulnerability Category page.


Last revision (mm/dd/yy): 05/27/2009

Vulnerabilities Table of Contents

Description

If one changes security privileges, one should ensure that the change was successful.

Consequences

  • Authorization: If privileges are not dropped, neither are access rights of the user. Often these rights can be prevented from being dropped.
  • Authentication: If privileges are not dropped, in some cases the system may record actions as the user which is being impersonated rather than the impersonator.

Exposure period

  • Implementation: Properly check all return values.

Platform

  • Language: C, C++, Java, or any language which can make system calls or has its own privilege system.
  • Operating platforms: UNIX, Windows NT, Windows 2000, Windows XP, or any platform which has access control or authentication.

Required resources

A process with changed privileges.

Severity

Very High

Likelihood of exploit

Medium

In Microsoft operating environments that have access control, impersonation is used so that access checks can be performed on a client identity by a server with higher privileges. By impersonating the client, the server is restricted to client-level security - although in different threads it may have much higher privileges.

Code which relies on this for security must ensure that the impersonation succeeded - i.e., that a proper privilege demotion happened.

Risk Factors

TBD

Examples

In C/C++

bool DoSecureStuff(HANDLE hPipe){ {
   bool fDataWritten = false;
   ImpersonateNamedPipeClient(hPipe);
   HANDLE hFile = CreateFile(...);
   /../ RevertToSelf()/../
}

Since we did not check the return value of ImpersonateNamedPipeClient, we do not know if the call succeeded.


Related Attacks


Related Vulnerabilities


Related Controls

  • Implementation: In Windows make sure that the process token has the SeImpersonatePrivilege(Microsoft Server 2003).
  • Implementation: Always check all of your return values.


Related Technical Impacts


References

TBD